I run debian with full encryption and wonder why I would also need a password protection for the bootloader...

  • 1
    What threat models are you interested in addressing? – Stephen Kitt Sep 17 at 13:40
  • If someine gets hold of my laptop, I want to make sure he cannot access data on my HDD. Encryption should be enough I assume – Debiannewb01 Sep 18 at 7:31

If the attacker has had full physical access to your device, your password protection is void and null because the attacker could:

  • plant a hardware backdoor
  • change your initrd in ways which allow to compromise your boot process and the installed OS

The GRUB password might protect from inexperienced hackers but not from sophisticated ones. I personally use full disk encryption and I didn't set the GRUB password.

| improve this answer | |
  • thank you, I was thinking the same – Debiannewb01 Sep 18 at 7:31
  • 1
    I agree, and have the same sort of setup ;-). For more on this, look up evil maid attacks. – Stephen Kitt Sep 18 at 7:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.